CVE-2026-81161: CWE-267 Privilege Defined With Unsafe Actions in Drupal Content Moderation Notifications

This vulnerability (CVE-2026-81161) in Drupal's Content Moderation Notifications module is classified under CWE-267 (Privilege Defined With Unsafe Actions). It allows for privilege escalation due to unsafe privilege definitions. The affected versions include 0.0.0 through 3.9.0. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impacts with no availability impact. No vendor advisory or patch information is currently available, and no exploits are known in the wild.

The vulnerability could allow an attacker with high privileges to escalate their privileges further by exploiting unsafe privilege definitions in the Content Moderation Notifications module. The impact is limited to low confidentiality and integrity loss, with no availability impact. Given the low CVSS score and lack of known exploits, the immediate risk is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and restrict privileges related to the Content Moderation Notifications module to minimize exposure. Monitor official Drupal channels for updates regarding patches or mitigations.